97% of organisations have been hit by an AI-facilitated attack. We're building agentic checkout on top of that.
97% of organisations have experienced an AI-facilitated attack, at an average direct loss of $4.5M.
78% of financial institutions expect AI-agent-linked fraud to rise. 87% of CTOs say trust is the single biggest barrier to agentic commerce. Visa logged a 25% spike in malicious bot-initiated transactions in six months — 40% in the US specifically.
And we are, right now, racing to let autonomous agents hold payment credentials and buy things on people's behalf.
I want to be clear: I think agentic commerce is real and I think it's coming. I also think the security conversation is happening at about a third of the volume of the opportunity conversation, and that ratio is how expensive lessons get learned.
The case FOR moving fast anyway:
The market forecasts are enormous — Bain has US agentic commerce at $300-500B by 2030, McKinsey at $1T in US retail revenue
Waiting for a standard means arriving after the defaults are set. Whoever the agents learn to trust first has a durable advantage
Fraud has never stopped a payment innovation. Cards, ecommerce, mobile wallets, BNPL — all shipped insecure and hardened later
The case AGAINST:
"Hardened later" is doing a lot of work in that sentence. It usually means somebody ate the losses in the meantime
Bot traffic that looks like a legitimate agent is a fundamentally harder distinguishing problem than bot traffic that looks like a bot
Consumer trust is fragile and non-linear. Only 14% currently trust AI to place an order independently. One well-publicised agentic fraud story and that number goes down, not up
Liability is genuinely unresolved. If an agent buys the wrong thing, who's responsible — the merchant, the platform, the model provider, the shopper?
Where I land: build the agent-readable layer now, and be extremely deliberate about the agent-transactable layer.
Being described accurately to an AI costs you nothing and risks nothing. Accepting autonomous purchases carries real exposure and should wait for real standards and real liability answers.
Those are two different projects and most roadmaps have them as one.
For anyone working in payments or fraud right now — is the industry underreacting to this, or am I overreacting? I'd rather be wrong loudly than right quietly.
Notes on the data
The number that should govern your roadmap: 65% of consumers trust AI to compare prices, only 14% trust it to place an order.
That gap is the market. Everything on the comparison side is available to you now. Everything on the transaction side is waiting on standards and liability answers that don't exist yet.
Build for the 65%. Watch the 14%.